Tasklist - DOS/Command Prompt Reference
[Windows NT series] Displays a list of processes running on the computer.
tasklist[.exe] [/S <remote-system> [/U <user-name> [/P [<password>]]]] [/M [<module-name>] | /SVC | /V] [/APPS] [/FI <filter>] [/FO <output-format>] [/NH]
|/S <remote-system>||Specifies the name of the computer (local/remote) from which to retrieve a list of processes. <remote-system> will be an IP address or hostname. If omitted, the local computer is the target.|
|/U <user-name> [/P [<password>]]||
Specifies the login name and password when providing a computer name. You can specify a domain name in <user-name> (in the form of ‘domain\username’). If omitted, the user who executed this command will be used.
On ‘/P [<password>]’, if the entire ‘/P [<password>]’ is omitted, no password is set. If only ‘/P’ is specified (and ‘<password>’ is omitted), prompting the user to enter the password will occur (the entered password will be displayed as ‘*’ in the prompt).
If <module-name> is specified, displays only the processes that have loaded the module (DLL, etc.) specified in <module-name>. <module-name> can have the wildcard ‘*’ specified only at the end.
If <module-name> is not specified, and only ‘/M’ is specified, displays all the module names that the process has loaded when showing the list of processes. Note that this operation may take some time.
If ‘/M’ is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will not be displayed.
You can obtain the same list using ‘/FI "MODULES eq <module-name>"’, but when specified with a filter, the module name will not be displayed.
/M cannot be specified with /SVC and /V.
|/SVC||When displaying the list of processes, shows the names of the ‘services’ associated with each process. If /SVC is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will not be displayed.|
Displays the ‘Status’, ‘User Name’, ‘CPU Time’, and ‘Window Title’ items in the list of processes. Depending on the situation, obtaining this information may take some time.
If /V is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will also be displayed.
[Windows 10? or later] Displays only processes based on Microsoft Store applications.
/APPS cannot be specified with /M and /SVC , but can be specified with /V.
Narrows down (filters) the processes to be displayed in the list of processes. Please refer to Details for the available formats that can be specified.
/FI can be specified multiple times. In such cases, it becomes an AND search (display only those that match all filters).
Specifies the format for outputting to the screen. The three available values are as follows. If /FO is omitted, it defaults to ‘TABLE’.
|/NH||Does not output headers when displaying in TABLE or CSV format.|
The Tasklist command outputs processes that match the specified filters among the running processes. If you want to terminate a process, use Taskkill.
Filters specified with the /FI option are in the form of ‘<name> <op> <value>’ (enclose the entire expression in " "). The available filters are as follows (same as those that can be used with Tasklist, excluding ‘SESSIONNAME’).
|Filter name <name>||Available comparison op. <op>(*)||Target|
|CPUTIME||eq, ne, gt, lt, ge, le||CPU time. <value> must be the format ‘hh:mm:ss’ (hours:minutes:seconds; minutes and seconds are one or two digits).|
|IMAGENAME||eq, ne||Process name (Image name). <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ . (It is not a partial match.)|
|MEMUSAGE||eq, ne, gt, lt, ge, le||Memory usage. <value> must be a numeric value (in KiB).|
|MODULES||eq, ne||Modules loaded by the process. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ . A single process typically loads multiple modules, but with this filter, the process is included in the results if any of the modules meet the specified conditions.|
|PID||eq, ne, gt, lt, ge, le||Process ID. <value> must be a numeric value.|
|SERVICES||eq, ne||Service name that the process belongs to. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ . A single process may belong to multiple services, but with this filter, the process is included in the results if any of the services meet the specified conditions.|
|SESSION||eq, ne, gt, lt, ge, le||Session number. <value> must be a numeric value.|
|SESSIONNAME||eq, ne||Session name. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ .|
|STATUS(*)||eq, ne||Process status. <value> must be either of ‘RUNNING’, ‘NOT RESPONDING’, or ‘UNKNOWN’.|
|USERNAME||eq, ne||User name. <value> must be the format ‘[Domain-name\]User-name’. You can use the wildcard ‘*’ at the end of ‘User-name’.|
|WINDOWTITLE(*)||eq, ne||Title name of the main window that the process possesses. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ .|
- * Comparison ops. are: eq: equal, ne: not equal, gt: greater than, lt: less than, ge: greater than or equal to, le: less than or equal to
- * When targeting processes on a remote computer, ‘STATUS’ and ‘WINDOWTITLE’ cannot be used.
The order of items output in TABLE or CSV is as follows. Numbers indicate the position in CSV, and ‘×’ indicates that the item is not output.
tasklist /FI "imagename eq excel*"
Displays a table of processes whose image name (process name) starts with ‘excel’.
tasklist /FI "pid lt 1000" /FO CSV
Displays processes with a Process ID less than 1000 in CSV format.
Sample 3 (Batch file)
type NUL > nplist.txt for /f "usebackq tokens=1,2 delims=," %%a in (`tasklist /FI "imagename eq notepad*" /FO CSV /NH`) do ( echo %%~a: %%~b>> nplist.txt )
[Extensions] Retrieves processes with an image name (process name) starting with ‘notepad’ and outputs their image name and PID to the file ‘nplist.txt’. Using For, the script parses the output of Tasklist, and assigns the first (image name) and second (PID) elements of CSV to variables %%a and %%b. Note that since the values are enclosed in " ", the ‘~’ modifier is used to remove them (see ‘%’).
* If no matching processes are found, an error message will be displayed on the screen.